12 ms·
Experiments with disabling the ME on Sandybridge x230
- lifeisstillgood 10y agoI am fascinated by this - is there no where that is leading the charge to develop personal computing devices that are truly open? What cost level are we really talking here?
- ashitlerferad 10y agoFirst you have to build a Fab that you trust. Then build an assembly line that you trust. Then make sure these don't have any humans in them, since humans are not trustworthy.
- colejohnson66 10y agoThere are some places that are trying to do fully open source hardware, but because the majority of the public doesn't care (they just want their computer to work), nothing big has come out yet.
- drvdevd 10y agoInteresting that the ME region can be even partially overwritten and will still let the system boot, albeit with an error (guessing a checksum mismatch)...
- drvdevd 10y agoAh ... reading further down the thread its explained and is even more interesting: https://www.coreboot.org/pipermail/coreboot/2016-September/082019.html https://www.coreboot.org/pipermail/coreboot/2016-September/0...
- DashRattlesnake 10y ago> along with the fact that the ME will sync it's internal clock with NTP servers across the internet once every 30 days Wow. This is part of the processor?
- yuhong 10y ago"chipset" I think.
- jandrese 10y agoThe Management Engine, think of it as running at Ring -1. It can access hardware below the level of the processor. Injecting malware into it would be the holy grail for attackers, it would be impossible for anything running on the CPU to detect it and the malware would have access to all of the low level hardware. It can even intercept or create packets on the network interfaces. Luckily the implementation is obscure so it has perfect security, right? There's no way such a complex piece of software that has had very little oversight could have exploitable bugs that would completely destroy any security foundations you have on your machine.
- drvdevd 10y ago> It can even intercept or create packets on the network interfaces. And appears to be built to do so out of the box by default with no "specialized code". I'm guessing with both wired and wireless interfaces... crazy!
- deleted 10y ago[deleted]
- drvdevd 10y agoMy next question is (and it's probably mentioned further in the thread or manual somewhere): how does the ME chipset route traffic to the Internet in the first place? Piggyback off the OS? Does this mean it's directly coupled with the networking devices on the system somehow? Presumably it will work with any OS....
- Jerry2 10y agoWhat are the odds that NSA already has the source of ME and can infect it like they can infect HDD ROM?
- a3n 10y agoWhat are the odds that it was put there at their request, or partially specified by them? After all, the clipper chip never went anywhere, but neither did the desire.
- yuhong 10y agoI know that the laptop anti-theft arms race is a bad idea for a while now.
- l3m0ndr0p 10y agoIt never was about theft, from the bad guy vs good guy point of view. It's about enabling a mechanism for the appropriate authority to gain access to your system. Since your hardware is not property, it's licensed, the appropriate authority has access, either through a warrant or some other "law" based process (or not).
- AdmiralAsshat 10y agoIt's a shame that we seem locked into using Intel or AMD for x64 processors, both of which have secondary, black-box processors. Isn't x64 a standard? Couldn't another company create their own implementation of it and design their own processors for the paranoid to use?
- Fej 10y agox86 is an Intel standard; they own the patents. Some of the patents have expired at this point but there's new ones which you would need in order to make a competing x86 processor. x86_64 is an AMD standard, I believe still under patent. Intel and AMD cross-license these patents to each other. As a result, any other company wanting to make x86 processors would have to purchase rights from both companies (assuming they're willing to, which is a big if), which would instantly make their products cost-uncompetitive.
- sliverstorm 10y agoIt's my understanding the only reason they cross-license today is both have big enough patent warchests as to place them in MAD. So it's probably quite unlikely Joe Startup could ever get a license.
- unsignedqword 10y agoThere have been rumors (for a while) that VIA is looking to seriously get back in the x64 game. So as far as I'm aware they have yet to attempt anything like Intel ME/AMD PSP.
- sspiff 10y agoAMD64 is, as far as I know, not a standard. Even if it was, being a standard does not mean that it is free, easy and legal for others to implement. Some standard bodies require a patent sharing agreement or licenses being provided for a "reasonable" cost, but what is reasonable is often a topic of discussion. x86_64 also incorporates a 32-bit compatibility, which is copyright protected by Intel and only a handful of licensees exist, with no new licenses having been signed in the past decade or so. I don't think you can implement AMD64 without also acquiring an x86 license from Intel.
- gravypod 10y agoDoes someone have a link to where I can download a few copies of different ME regions for some CPUs. I'd love to get a look at what it's doing.
- dragontamer 10y agoCan someone describe what a "ME Region" is?
- yuhong 10y agowhere ME is stored I think.
- wongarsu 10y agoThe region of the "bios" flash chip which stores the code for the Intel Management Engine.
- deleted 10y ago[deleted]
- Lagged2Death 10y agoThis has an editorial point of view, for sure, but it's also an approachable introduction: http://boingboing.net/2016/06/15/intel-x86-processors-ship-with.html http://boingboing.net/2016/06/15/intel-x86-processors-ship-w...
- eloy 10y agoIt's a shame that ME can't be removed or disabled on modern Intel CPU's. Same goes for AMD and maybe companies that implement something like ME in ARM. OpenSPARC is quite dead, sadly enough. Highly recommended read about x86 security: http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf The author of this paper is also the developer of Qubes OS. They recently added another requirement to laptops who are 'Qubes certified': they must run Coreboot. It's not Libreboot yet, but that is a huge leap forward for x86 security. Hopefully this will trigger vendors to make their hardware Coreboot compatibile. It won't do anything about Intel ME, but it is a step in the right direction. I ordered a Thinkpad x200 to flash it with Libreboot last week, just to have at least one device without any malware (in RMS sense)
- subway 10y agoI have hope in Risc-V.
- eloy 10y agoI don't have any hope for other hardware. The only hope that I have is that Intel will change their mind and remove it, or make it fully open source. The sad thing is that ME isn't even developed by Intel, but a third party. They sublicense it to Intel. So even if Intel would be willing to distribute the source, they couln't.
- userbinator 10y agoI think someone has to leak everything, Snowden-style, although with all the increasing "security" that could be a bit difficult... nevertheless, if someone does decide to be a hero and do it, I fully support their efforts.
- dmfdmf 10y agoUnless this leak revealed that the NSA forced Intel and AMD to include ME in their chips to advance their mass spying efforts such a leak would be a crime. Snowden's case is different since he was revealing info that Americans (or their reps) have a right to know. The intelligence agencies are building a mass surveillance infrastructure that is prima facie not compatible with a free country and almost certainly a violation of the constitution. The constitution and amendments do not directly apply to Intel and they are free to do whatever they want and we are free to buy or not to buy as we see fit. TBH, I think there is a lot of focus on this ME technology and I see no reason that at some point someone is going to crack the model or the encryption and reveal exactly what it is doing and how to disable it.
- 0x0 10y ago"(...) the ME will sync it's internal clock with NTP servers across the internet once every 30 days, to make CRL checks for the remote management PKI work." (in https://www.coreboot.org/pipermail/coreboot/2016-September/082019.html https://www.coreboot.org/pipermail/coreboot/2016-September/0... ) That's pretty crazy to think there's a sub-ring-0 rootkit running on your CPU contacting NTP servers without your knowledge. Does that work over wifi (where does it get the WPA password from)? Where does it get an IP address? Does it leech off the host's DHCP IP by intercepting ethernet packets? Is there any way to fingerprint the traffic? TTLs, sequence numbers, etc? It'd be interesting to run a system behind a router for a while while logging all ME traffic...
- jcrawfordor 10y agoFor this NTP check to happen, you must be using a computer with Intel MEBX and an Intel AMT-enabled network adapter, and the network adapter must be configured with network information to use. You have to do this manually initially, although of course later you can configure AMT using AMT. This isn't something your consumer computer is doing automatically, in fact, your computer is almost certainly not capable because it lacks an AMT-capable NIC. I suspect the software capability is baked into ME itself rather than the AMT component so it's probably present in your ME, but it's not doing anything without an AMT NIC to communicate with. This is the kind of feature that you pay an extra $1k for when you configure your $20k server.
- seanp2k2 10y agoNot specifically ME but yeah Baseboard Management Controllers and IPMI modules have been a thing for a long time. Most real server motherboards have them or have the facilities in place to accept them as an add-on module. It's not even just stuff in the $20k range; this $450 mini itx 8-core Atom-based storage server board has it: http://www.asrockrack.com/general/productdetail.asp?Model=C2750D4I#Specifications http://www.asrockrack.com/general/productdetail.asp?Model=C2... and it comes with a web-based IPMI console. You can turn the power on and watch it POST with a java web screen viewer, sending it keys as if you were sitting there. Dell's add-in card to do out-of-band management is called the DRAC and it's been optional in their servers for about 17 years: https://en.m.wikipedia.org/wiki/Dell_DRAC https://en.m.wikipedia.org/wiki/Dell_DRAC
- Animats 10y ago"The ME code to start the platform is in (on-chip) ROM and a failed signature check of the (compressed with AFAIK still unknown codebook) ME code in flash just means that the ME considers the system broken and allows it to run for a little while so that a human can repair it." So 1) will the system stay up with the ME software erased, 2) what's the ROM component doing besides managing the boot, and 3) what access does it take to alter the ME's firmware?
- yuhong 10y agoThe ME firmware is signed by Intel I think.
- yellowapple 10y agoSo compromise their signing keys and we have a wide-open door to neutralizing (and/or replacing) ME, right?
- DeepYogurt 10y agoNot to be pedantic, but the x230 has an ivybridge chip.